How to Use NMAP to Scan for Open Ports

Learn the Basics of NMAP and Open Port Detection

NMAP (short for Network Mapper) helps users identify active services and potential security weaknesses on computer networks. Port scanning with NMAP allows system administrators and security professionals to detect open ports, check network security, and find vulnerabilities.

This tool provides accurate network mapping and security auditing capabilities through its command-line interface. Users can scan single hosts or entire networks to gather information about available services, operating systems, and firewall configurations. NMAP’s scanning features include TCP scans, UDP scans, version detection, and OS fingerprinting.

Security teams use these results to strengthen network defenses and ensure compliance with security policies. Understanding NMAP’s basic commands and options helps users perform effective network surveillance and security assessments.

Prerequisites Before Scanning with NMAP

Before scanning with NMAP, there are a few prerequisites:

A Step-by-Step Guide to Use NMAP to Scan for Open Ports

Step 1: Perform a Basic NMAP Scan for Open Ports

To start, we will perform a basic NMAP scan to find open TCP ports on the target hosts.

The basic syntax for a TCP connect scan is:

nmap <target>

Where <target> is the IP address or hostname you want to scan.

For example, to scan a single IP address:

nmap 192.168.1.105

To scan a hostname:

nmap example.com

And to scan an entire subnet range:

nmap 192.168.1.1-254

This will perform a fast TCP connect scan on the most common 1000 ports using SYN packets. Any actively listening ports will show up as open.

Step 2: Service and Version Detection

The basic scan only identifies open ports. To determine which services and application versions are running on the open ports, add the -sV option:

nmap -sV <target>

This will probe each open port and attempt to identify the service listening on the port along with its application version. This is useful when you need to determine specific services running on the host.

Step 3: Perform More Advanced Scans for Accuracy

The TCP connect scan is fast but can generate false positives for open ports due to the way it works. To improve accuracy, you can use a more advanced scan like the TCP SYN scan:

nmap -sS <target>

This sends raw SYN packets like the connect scan but identifies open ports differently, reducing false positives.

For the highest accuracy, perform a full TCP port scan:

nmap -p 1-65535 -sS -sV <target>

This scans all 65535 TCP ports using the SYN scan while also determining service versions. Use this for critical scans where you need complete accuracy.

Step 4: Quickly Scan the Most Important Ports

Scanning all 65535 TCP ports can take a long time. In many cases, you only need to check the most common 1000 ports where services typically run:

nmap --top-ports 1000 <target>

This will scan only the top 1000 TCP ports. If you know your specific service runs on a non-standard port, you can extend the set of ports to scan:

nmap --top-ports 1000 -p 1234,3000-4000 <target>

This will scan the top 1000 along with ports 1234 and 3000-4000. Adjust as needed for your environment.

Step 5: Find UDP Open Ports

So far, we have only scanned TCP ports. To check for open UDP ports, use the -sU option:

nmap -sU -p 123,161,500 <target>

This will scan UDP ports 123, 161, and 500, which are common for services like DNS, SNMP, and IPsec. Adjust the ports as required.

You can combine -sU for UDP with -sS or -sT for TCP scans.

Step 6: Increase Speed for Faster Scanning

By default, NMAP scans up to 10 ports simultaneously. This prevents overload, but it can be slow on high-latency networks.

To increase scanning speed, raise the parallelism level with -T:

nmap -T4 <target>

Levels go from 0 (serial) to 5 (insane). Be careful not to overload your network or target. -T3 is a good moderate setting.

Step 7: Output Options for Reports and Integration

By default, NMAP prints output to the screen. There are various options to save output to a file or integrate with other tools:

For example:

nmap -oA portscan 192.168.1.105

This will save the results as portscan.NMAP, portscan.xml, and portscan.gNMAP in your current directory.

Step 8: Useful NMAP Options

Here are some other useful NMAP options:

Review the NMAP documentation for many more options.

Step 9: Some Useful NMAP Scanning Commands

Here are some handy NMAP scanning commands for quick reference:

# Scan a host for most common 1000 ports
nmap 192.168.1.105

# Scan a host for all TCP ports
nmap -p 1-65535 192.168.1.105 -sV

# Quick scan for most common services
nmap --top-ports 100 192.168.1.105 -F

# Scan a subnet for only specific UDP ports
nmap -sU -p 161,500 192.168.1.1-254

# Scan a host showing only open ports and services
nmap -sV --open 192.168.1.105

# Quick traceroute and port scan together
nmap -sV --traceroute 192.168.1.105

# Scan a firewall protected host
nmap -sA 192.168.1.105

# Scan for versions and vulnerabilities
nmap -sV --script vuln 192.168.1.105

# Scan multiple hosts from file
nmap -iL hosts.txt

Adjust these examples with your own IP addresses, ports, and options as required.

Step 10: Useful GUI Frontends for NMAP

If you prefer a graphical interface over the command line, some useful GUI tools for NMAP include:

These provide different levels of usability, visualization, reporting, and automation over raw NMAP.

Final Thoughts

NMAP remains an indispensable tool in network security and system administration. By mastering its various scanning techniques and options, administrators can effectively identify open ports, detect services, and assess potential vulnerabilities in their networks.

Regular port scanning helps maintain a robust security posture by identifying unauthorized services and ensuring only necessary ports remain open. While NMAP is powerful, users must remember to obtain proper authorization before scanning any networks and use the tool responsibly.

Whether for security auditing, network inventory, or troubleshooting, NMAP’s versatility and reliability make it the go-to choice for port scanning tasks.

Frequently Asked Questions (FAQs)

What is the difference between a TCP and UDP port scan in NMAP?

A TCP port scan sends SYN or connect packets to each port and listens for a response to identify open ports. A UDP port scan sends empty UDP packets and looks for ICMP port unreachable responses to determine open UDP ports.

How accurate are NMAP scans at finding open ports?

Basic TCP connect scans can sometimes generate false positives due to their way of identifying open ports. SYN, NULL, and FIN scans are more accurate as they work differently. UDP scans are also accurate for finding open UDP ports.

Can running NMAP trigger intrusion detection systems?

Yes, IDS/IPS solutions can detect and block NMAP scans, especially if you scan aggressively fast. To try to avoid detection, use slower scanning, fragment packets, or specify a source port.

Is there an easy way to save and compare NMAP scan reports?

The best way is to save scan results using—oA, which stores them in all major formats. You can compare scans using the diff tool included with NMAP by diffing text or XML files.

How can I scan an entire class C subnet range with NMAP?

You can specify a target range like 192.168.1.1-254 to scan 254 IPs of a class C subnet. NMAP also allows inputting ranges like 192.168.1.0/24. Make sure you have permission first.

What common TCP/UDP ports should I scan for in a basic NMAP scan?

For TCP, you should scan at minimum ports 20, 21 (FTP), 22 (SSH), 23 (Telnet), 25 (SMTP), 53 (DNS), Port 80 and Port 443 (HTTP/S), 110/143/993 (POP3/IMAP), and 3389 (RDP). For UDP, check 53 (DNS), 67/68 (DHCP), 123 (NTP), and 161 (SNMP) at a minimum.

How can I speed up NMAP scanning times on slow networks?

Increase the parallelism -T level to send more packets simultaneously. Reduce the port range to scan only required ports. Check the—- min-rate option to prevent packets from sending too slowly. Split the target range into smaller chunks.

What useful NMAP Scripting Engine scripts are available?

Some useful NSE scripts include vuln to scan for vulnerabilities, http-enum to enumerate web apps, smb-enum-shares for SMB shares, snmp-sysdescr to pull SNMP device details, and dns-zone-transfer to test zone transfers.

Is NMAP able to detect the operating system and hardware details of a host?

Yes, NMAP has excellent OS fingerprinting capabilities built in. Use the -O option to enable OS detection and try the smb-os-fingerprint NSE script to obtain detailed SMB host information.

Can I integrate NMAP port scanning into a Python or Bash script?

Definitely, NMAP provides a handy command line interface that can be easily integrated into Python/Bash scripts to automate scanning in pipelines or as part of larger tools. The NMAP Python module also allows programmatic access to run scans.

Priya Mervana

Verified Web Security Experts

Priya Mervana is working at SSLInsights.com as a web security expert with over 10 years of experience writing about encryption, SSL certificates, and online privacy. She aims to make complex security topics easily understandable for everyday internet users.